Data transmission method, device and system

Abstract

The invention discloses a data transmission method, device and system, and relates to the technical field of multimedia. The method can be applied to monitoring equipment, and comprises the following steps: the monitoring equipment can encrypt a second key by using a first key to obtain a third key; the first key is used for encrypting a second key corresponding to the video and audio data, and the second key is used for encrypting the video and audio data. The monitoring device can also utilize the second secret key to encrypt the video and audio data to obtain encrypted data and send the video and audio stream to the server. The video and audio stream comprises the content identifier of the video and audio data, the third key and the encrypted data. The video stream can be ensured not to be acquired or leaked in the transmission process, the security of data transmission is improved, and the privacy in the data is protected.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of multimedia technologies, and in particular, to a data transmission method, apparatus, and system. Background Art

[0002] As a representative of intelligent hardware, an intelligent camera can collect audio-visual data and transmit the audio-visual data over a network. For example, the intelligent camera sends the collected audio-visual data to a server to implement audio-visual communication services and real-time monitoring services, etc., thereby bringing a more convenient experience to users. How to ensure the security and privacy protection of data during network transmission while bringing a good user experience has become an urgent problem to be solved. Summary of the Invention

[0003] The present application provides a data transmission method, apparatus, and system. Thus, a monitoring device can generate a key for encrypting audio-visual data and encrypt the audio-visual data. During the process of transmitting the encrypted audio-visual data over the network, the key for encrypting the audio-visual data and the encrypted audio-visual data will not be exposed, improving the security of data transmission and protecting the privacy in the data.

[0004] To achieve the above object, the present application adopts the following technical solutions:

[0005] In a first aspect, a data transmission method is provided, which is applied to a monitoring device. The method includes:

[0006] The monitoring device can encrypt a second key with a first key to obtain a third key. The first key is used to encrypt the second key corresponding to the audio-visual data, and the second key is used to encrypt the audio-visual data. The monitoring device can also encrypt the audio-visual data with the second key to obtain encrypted data, and send an audio-visual stream to the server. The audio-visual stream includes a content identifier of the audio-visual data, the third key, and the encrypted data.

[0007] In this way, the monitoring device can protect the second key with the first key and encrypt the audio-visual data with the second key. The encrypted data in the video stream sent by the monitoring device is encrypted with the second key, and the third key is obtained by encrypting the second key with the first key. In addition, the monitoring device does not transmit the first key and the second key. In this way, the third key and the encrypted data cannot be cracked, so as to ensure that the video stream cannot be obtained or leaked during the transmission process, improving the security of data transmission and protecting the privacy in the data.

[0008] In a feasible implementation manner, the monitoring device can also perform key negotiation with an electronic device to generate the first key.

[0009] The monitoring device can negotiate a key with the electronic device to generate a first key, which is used for encrypting the video and audio data. In this way, the monitoring device can generate a first key for encrypting the second key. By generating the first key, the second key can be protected, enhancing the security of the second key. At the same time, the first key is generated by the monitoring device itself and is not exposed in the network. In this way, when encrypting video and audio data is transmitted subsequently, the security of data transmission and the privacy protection of the data can be improved.

[0010] In another implementable manner, the monitoring device can also generate a second key.

[0011] In this way, the monitoring device can generate a second key, which is used for encrypting video and audio data. The monitoring device can use the second key generated by itself to encrypt the collected video and audio data. In this way, during the subsequent process of the monitoring device transmitting encrypted video and audio data over the network, the second key will not be exposed, and the encrypted video and audio data will not be decrypted, improving the security of data transmission. Furthermore, the user experience is improved.

[0012] In one implementable manner, the monitoring device can apply for a first certificate from the certificate authority according to the first public key of the monitoring device. The first certificate is used for binding the electronic device and the monitoring device.

[0013] The monitoring device can apply for a first certificate from the certificate authority according to the first public key generated by itself, so that subsequent identity verification and data communication can be carried out with the electronic device using the first certificate, improving the interactivity between the two devices. Furthermore, the user can control the monitoring device through the electronic device, enhancing the interactivity between the user, the electronic device, and the monitoring device, and improving the user experience.

[0014] In one implementable manner, the monitoring device can also receive a certificate exchange request sent by the electronic device and send the identification information and the first certificate of the monitoring device to the electronic device.

[0015] The monitoring device can interact with the electronic device regarding the certificate and the identification information, sending its own identification information and the first certificate to the electronic device for identity verification between the two devices. At the same time, it facilitates the subsequent electronic device to perform the binding process and request the server to bind the electronic device and the monitoring device. In this way, the two devices can communicate and share data. The operability of the user for the monitoring device is improved, ensuring the user experience.

[0016] In a second aspect, a data transmission method is provided, which is applied to an electronic device. The method includes: The electronic device can negotiate a key with a monitoring device to generate a first key, and send the content identifier of the audio-visual data to the monitoring device. The content identifier of the audio-visual data is used for the monitoring device to establish a corresponding relationship between the generated first key and the content identifier. The first key is used to encrypt a second key corresponding to the audio-visual data, and the second key is used to encrypt the audio-visual data.

[0017] In this way, the electronic device can negotiate with the monitoring device to generate a first key, and send the content identifier of the audio-visual data to the monitoring device, so that the monitoring device can establish a corresponding relationship between the generated first key and the content identifier. In this way, the electronic device can establish an association with the first key of the monitoring device through the content identifier, which is convenient for controlling the subsequent use of the first key by the monitoring device to encrypt the second key. This improves the interactivity between the electronic device and the monitoring device. The user can also control the monitoring device through the electronic device, improving the user's operability of the monitoring device and ensuring the user's experience.

[0018] In an implementable manner, the electronic device can receive a playback operation for the audio-visual data, send an audio-visual stream acquisition request, and receive the audio-visual stream sent by the server. The audio-visual stream includes the content identifier of the audio-visual data, a third key, and encrypted data. The encrypted data is encrypted by the second key, and the third key is obtained by encrypting the second key with the first key. The electronic device can also decrypt the third key according to the first key corresponding to the content identifier of the audio-visual data to obtain the second key. Then, the electronic device uses the second key to decrypt the encrypted data to obtain the audio-visual data and plays the audio-visual data.

[0019] In this way, the electronic device can decrypt the third key in the video stream with the first key to obtain the second key, and then obtain the decrypted audio-visual data through the second key. The electronic device can decrypt the audio-visual stream with the first key negotiated with the monitoring device to obtain the audio-visual data. In this way, the user can view and review the audio-visual data collected by the monitoring device in real time through the electronic device, which can provide more user-friendly functions and improve the interactivity between the user and the electronic device.

[0020] In an implementable manner, the electronic device can receive a sharing operation for the audio-visual data, apply to the server for at least one shared device bound to the monitoring device and the third certificates of the at least one shared device, and generate a license for the at least one shared device based on the identification information and the third certificates of the at least one shared device. The electronic device can also send the license of the at least one shared device to the server, and the license is used for the at least one shared device to share the audio-visual data with the electronic device.

[0021] In this way, the electronic device can obtain the third certificates of at least one shared device in response to a sharing operation to authenticate the identity of the shared device. After determining that at least one shared device is a trusted device, the electronic device can generate a license for at least one shared device and send the license to the server, so that the subsequent at least one shared device can share audio-visual data with the electronic device through the license. In this way, the electronic device can restrict at least one shared device based on the license during the sharing process, improving the security of sharing audio-visual data. The electronic device can also provide a sharing function for the user with respect to the audio-visual data, improving the interactivity between the user and the electronic device. Furthermore, the user experience is enhanced.

[0022] In one implementable manner, when generating a license for at least one shared device based on the identification information and the third certificates of at least one shared device, the electronic device can encrypt a first key using the third public key in the third certificate to obtain a fourth key. The electronic device can also generate a first signature using the second private key of the electronic device and generate a license for at least one shared device according to the fourth key, the first signature, and the identification information of at least one shared device.

[0023] In this way, the electronic device can generate a first signature using its own private key and encrypt the first key using the public key in the shared device certificate. On the basis that the shared device can obtain the first key, the first key is protected to ensure that the first key will not be leaked or obtained during transmission, improving the transmission security of the first key. Thus, the transmission security of the license can also be improved. At the same time, the electronic device can also indicate its own identity through the first signature, facilitating subsequent verification of the signature by the shared device using the first signature and improving the reliability of the license.

[0024] In one implementable manner, when generating a license for at least one shared device according to the fourth key, the first signature, and the identification information of at least one shared device, the electronic device can configure shared information and generate a license for at least one shared device according to the shared information, the fourth key, the first signature, and the identification information of at least one shared device.

[0025] The shared information is used for the electronic device to share audio-visual data when running a target application; the shared information includes one or more of the application identifier of the target application, the validity period of the audio-visual data, the sharing method of the audio-visual data, and the permission information of the audio-visual data.

[0026] The validity period is used to characterize the effective time for the electronic device to share video and audio data with at least one shared device. The sharing method is used to characterize the communication connection method between the electronic device and at least one shared device when sharing video and audio data. The permission information is used to characterize the permission operation method of at least one shared device for the video and audio data when the electronic device shares the video and audio data;

[0027] In this way, the electronic device can configure the sharing information, and based on the sharing information, the fourth key, the first signature, and the identification information of at least one shared device, generate licenses for at least one shared device. The electronic device can restrict one or more of the sharing method, validity period, and sharing permissions of at least one shared device. In this way, by adding usage constraints to the license to manage various permissions such as the usage period, storage, and distribution of third-party device usage, the sharing security of video and audio data can be improved, and the privacy information in the video and audio data can be protected.

[0028] In an implementable manner, the electronic device can apply for a second certificate from the certificate authority according to the second public key of the electronic device; the second certificate is used for binding the electronic device and the monitoring device.

[0029] The electronic device can apply for a second certificate from the certificate authority according to the second public key generated by itself, so that subsequent identity verification and data communication can be carried out with the monitoring device using the second certificate, improving the interactivity between the two devices. Furthermore, the user can control the monitoring device through the electronic device, enhancing the interactivity between the user, the electronic device, and the monitoring device, and improving the user's experience.

[0030] In an implementable manner, the electronic device can send a certificate exchange request and receive the identification information and the first certificate of the monitoring device sent by the monitoring device. The electronic device can also send an association request and association information to the server. The association request is used to request binding the electronic device and the monitoring device. The association information includes the identification information of the monitoring device, the first certificate, the identification information of the electronic device, and the second certificate.

[0031] The electronic device can perform certificate and identification information interaction with the monitoring device to authenticate the identities of the two devices. After receiving the first certificate and identification information of the monitoring device, the electronic device can execute the binding process and request the server to bind the electronic device and the monitoring device. In this way, the two devices can communicate and share data. There is no need for the user to participate in complex verification and binding processes, improving the user's operability and ensuring the user's experience.

[0032] In an implementable manner, the electronic device can also receive the binding success response sent by the server and output a prompt message according to the binding success response. The prompt message is used to prompt that the electronic device and the monitoring device have been bound.

[0033] After the server successfully binds the electronic device and the monitoring device, it can send a binding success response to the mobile phone, and the mobile phone can give the user a binding success prompt, indicating that the electronic device and the monitoring device have successfully established a binding relationship. This can provide a more user-friendly function and improve the interactivity between the user and the electronic device.

[0034] Thirdly, a data transmission method is provided, which is applied to a transmission system. The transmission system includes an electronic device and a monitoring device, and the electronic device is used to control the monitoring device. The method includes: the electronic device negotiates a key with the monitoring device, generates a first key and sends the content identifier of the video and audio data to the monitoring device. The content identifier of the video and audio data is used for the monitoring device to establish a corresponding relationship between the generated first key and the content identifier. The first key is used to encrypt a second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data.

[0035] The monitoring device encrypts the second key with the first key to obtain a third key, and encrypts the video and audio data with the second key to obtain encrypted data. The monitoring device sends a video and audio stream, which includes the content identifier of the video and audio data, the third key, and the encrypted data.

[0036] In this way, the electronic device can establish an association with the first key of the monitoring device through the content identifier, which is convenient for controlling the subsequent monitoring device to encrypt the second key with the first key. This improves the interactivity between the electronic device and the monitoring device. The user can also control the monitoring device through the electronic device, which improves the operability of the user with respect to the monitoring device.

[0037] In addition, the monitoring device can protect the second key with the first key and encrypt the video and audio data with the second key. At the same time, the monitoring device does not transmit the first key and the second key. In this way, the third key and the encrypted data cannot be cracked, so as to ensure that the video stream cannot be obtained or leaked during the transmission process, improving the security of data transmission and protecting the privacy in the data.

[0038] In an implementable manner, the transmission system further includes a server, and the method further includes: the electronic device receives a play operation for the video and audio data, sends a video and audio stream acquisition request, and receives the video and audio stream sent by the server. The electronic device decrypts the third key according to the first key corresponding to the content identifier of the video and audio data to obtain the second key, and decrypts the encrypted data with the second key to obtain the video and audio data, and plays the video and audio data.

[0039] The electronic device can use the first key to decrypt the third key in the video stream to obtain the second key, and then obtain the decrypted video and audio data through the second key. The electronic device can use the first key negotiated with the monitoring device to decrypt the video and audio stream to obtain the video and audio data. In this way, the user can view and review the video and audio data collected by the monitoring device in real time through the electronic device, which can provide the user with more user-friendly functions and improve the interactivity between the user and the electronic device.

[0040] In an implementable manner, the electronic device receives a sharing operation for the video and audio data, and applies to the server for at least one shared device bound to the monitoring device and the third certificates of at least one shared device. The electronic device generates licenses for at least one shared device based on the identification information and third certificates of at least one shared device. The electronic device sends the licenses of at least one shared device to the server, and the licenses are used for at least one shared device to share the video and audio data with the electronic device.

[0041] The electronic device can obtain the third certificates of at least one shared device in response to the sharing operation to implement the authentication of the shared device. After determining that at least one shared device is a trusted device, the electronic device can generate licenses for at least one shared device and send the licenses to the server, so that subsequent at least one shared device can share the video and audio data with the electronic device through the licenses. In this way, the electronic device can restrict at least one shared device based on the licenses during the sharing process, improving the security of sharing the video and audio data. The electronic device can also provide the user with a sharing function for the video and audio data, improving the interactivity between the user and the electronic device. Furthermore, the user's usage experience is enhanced.

[0042] In an implementable manner, during the process of the electronic device generating licenses for at least one shared device based on the identification information and third certificates of at least one shared device, the electronic device can encrypt the first key with the third public key in the third certificate to obtain the fourth key, and generate the first signature using the second private key. The electronic device can also generate licenses for at least one shared device according to the fourth key, the first signature, and the identification information of at least one shared device.

[0043] The electronic device can generate the first signature using its own private key and encrypt the first key with the public key in the shared device certificate. On the basis that the shared device can obtain the first key, the first key is protected to ensure that the first key will not be leaked or obtained during the transmission process, improving the transmission security of the first key. Thus, the transmission security of the license can also be improved. At the same time, the electronic device can also indicate its own identity through the first signature, facilitating subsequent verification of the signature by the shared device using the first signature and improving the reliability of the license.

[0044] Fourthly, a communication device is also provided. The communication device includes a key encryption module and a communication module.

[0045] Among them, the key encryption module is used to encrypt the second key with the first key to obtain the third key; the first key is used to encrypt the second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data.

[0046] The key encryption module is also used to encrypt the video and audio data with the second key to obtain encrypted data.

[0047] The communication module is used to send a video and audio stream to the server. The video and audio stream includes the content identifier of the video and audio data, the third key, and the encrypted data.

[0048] In this way, the communication device can protect the second key with the first key and encrypt the video and audio data with the second key. The encrypted data in the video stream sent by the communication device is encrypted by the second key, and the third key is obtained by encrypting the second key with the first key. In addition, the communication device does not transmit the first key and the second key. In this way, the third key and the encrypted data cannot be cracked, so as to ensure that the video stream cannot be obtained or leaked during the transmission process, improve the security of data transmission and protect the privacy in the data.

[0049] Fifthly, a communication device is also provided. The communication device includes a key negotiation module and a communication module.

[0050] Among them, the key negotiation module is used to negotiate a key with the monitoring device to generate the first key.

[0051] The communication module is used to send the content identifier of the video and audio data to the monitoring device. The content identifier of the video and audio data is used for the monitoring device to establish the corresponding relationship between the generated first key and the content identifier. The first key is used to encrypt the second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data.

[0052] In this way, the communication device can negotiate with the monitoring device to generate the first key and send the content identifier of the video and audio data to the monitoring device, so that the monitoring device can establish the corresponding relationship between the generated first key and the content identifier. In this way, the communication device can establish an association with the first key of the monitoring device through the content identifier, which is convenient for controlling the subsequent monitoring device to encrypt the second key with the first key. The interactivity between the communication device and the monitoring device is improved. The user can also control the monitoring device through the communication device, improving the user's operability for the monitoring device and ensuring the user's experience.

[0053] In a sixth aspect, a monitoring device is further provided. The monitoring device includes a memory, one or more processors, and a camera; the camera is used to collect audio-visual data, and the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions. When the computer instructions are executed by the processor, the monitoring device is caused to execute the data transmission method as described in the first aspect above.

[0054] In a seventh aspect, an electronic device is further provided. The electronic device includes a memory, one or more processors; the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions. When the computer instructions are executed by the processor, the electronic device is caused to execute the data transmission method as described in the second aspect above.

[0055] In an eighth aspect, a transmission system is further provided, which includes an electronic device and a monitoring device. The electronic device is used to perform key negotiation with the monitoring device, generate a first key, and send the content identifier of the audio-visual data to the monitoring device. The content identifier of the audio-visual data is used for the monitoring device to establish a correspondence between the generated first key and the content identifier. The first key is used to encrypt a second key corresponding to the audio-visual data, and the second key is used to encrypt the audio-visual data.

[0056] The monitoring device is used to encrypt the second key with the first key to obtain a third key, and encrypt the audio-visual data with the second key to obtain encrypted data. The monitoring device is further used to send an audio-visual stream, and the audio-visual stream includes the content identifier of the audio-visual data, the third key, and the encrypted data.

[0057] In this way, the electronic device in the transmission system can establish an association with the first key of the monitoring device through the content identifier, which is convenient for controlling the subsequent monitoring device to encrypt the second key with the first key. The interactivity between the electronic device and the monitoring device is improved. The user can also control the monitoring device through the electronic device, improving the operability of the user with respect to the monitoring device.

[0058] In addition, the monitoring device can protect the second key with the first key and encrypt the audio-visual data with the second key. At the same time, the monitoring device does not transmit the first key and the second key. In this way, the third key and the encrypted data cannot be cracked, thereby ensuring that the video stream cannot be obtained or leaked during the transmission process, improving the security of data transmission and protecting the privacy in the data.

[0059] In a ninth aspect, a computer-readable storage medium is further provided. Instructions are stored in the computer-readable storage medium. When the instructions run on a computer, the computer can execute the data transmission method as described in the first aspect above, or execute the data transmission method as described in the second aspect above. Description of the Drawings

[0060] Figure 1 A structural schematic diagram of data transmission provided by an embodiment of the present application;

[0061] Figure 2 A structural schematic diagram of a transmission system provided by an embodiment of the present application;

[0062] Figure 3 A hardware structural schematic diagram of a mobile phone provided by an embodiment of the present application;

[0063] Figure 4 A hardware structural schematic diagram of a monitoring device provided by an embodiment of the present application;

[0064] Figure 5 An interface schematic diagram of an adding device provided by an embodiment of the present application;

[0065] Figure 6 An interface schematic diagram of device binding provided by an embodiment of the present application;

[0066] Figure 7 An interaction schematic diagram of a certificate downloading process provided by an embodiment of the present application;

[0067] Figure 8 An interface schematic diagram of a prompt message provided by an embodiment of the present application;

[0068] Figure 9 An interaction schematic diagram of data transmission provided by an embodiment of the present application;

[0069] Figure 10 An interface schematic diagram of a to-be-played interface provided by an embodiment of the present application;

[0070] Figure 11 An interaction schematic diagram of an electronic device playing video and audio data provided by an embodiment of the present application;

[0071] Figure 12 An interface schematic diagram of a sharing interface provided by an embodiment of the present application;

[0072] Figure 13 An interaction schematic diagram of generating a license provided by an embodiment of the present application;

[0073] Figure 14 An interaction schematic diagram of a shared device playing video and audio data provided by an embodiment of the present application;

[0074] Figure 15 A structural schematic diagram of a communication device provided by an embodiment of the present application. Detailed implementation manners

[0075] In the description of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship. For example, A / B may represent A or B. The "and / or" in the present application is merely a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. Here, A and B can be singular or plural.

[0076] In the description of the present application, unless otherwise specified, "a plurality of" means two or more than two. "At least one (item)" or its similar expressions refer to any combination of these items, including any combination of single item (s) or plural items (s). For example, at least one (item) of a, b, or c can represent: a, b, c, a - b, a - c, b - c, or a - b - c, where a, b, c can be single or plural.

[0077] In addition, for the convenience of clearly describing the technical solutions of the embodiments of the present application, in the embodiments of the present application, terms such as "first" and "second" are used to distinguish the same items or similar items with basically the same functions and roles. Those skilled in the art can understand that terms such as "first" and "second" do not limit the quantity and execution order, and "first", "second", etc. do not necessarily mean different.

[0078] In the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations, or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or having more advantages than other embodiments or design solutions. Rather, the use of words such as "exemplary" or "for example" is intended to present relevant concepts in a specific manner for easy understanding.

[0079] It can be understood that the "embodiments" mentioned throughout the specification mean that specific features, structures, or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, the various embodiments throughout the specification do not necessarily refer to the same embodiments. In addition, these specific features, structures, or characteristics can be combined in one or more embodiments in any suitable manner. It can be understood that in the various embodiments of the present application, the magnitude of the sequence number of each process does not mean the order of execution is prior or posterior, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.

[0080] It can be understood that in the present application, both "when..." and "if" refer to corresponding processing under certain objective circumstances, not limited to time, and do not require a judgment action when implemented, nor does it mean there are other limitations.

[0081] It can be understood that some optional features in the embodiments of the present application can, in certain scenarios, be implemented independently without relying on other features, such as the current solution they are based on, to solve corresponding technical problems and achieve corresponding effects. In some scenarios, they can also be combined with other features according to requirements. Correspondingly, the devices given in the embodiments of the present application can also implement these features or functions accordingly, which will not be elaborated here.

[0082] To facilitate the understanding of the technical solutions of the embodiments of the present application, a brief introduction to the related technologies of the present application is first given as follows.

[0083] 1. Public Key Infrastructure (PKI):

[0084] PKI is an infrastructure that provides security services using asymmetric cryptography theory and technology. The main function of PKI is to bind the identity of the certificate holder and the related key pair, provide users with convenient ways for certificate application, certificate revocation, certificate acquisition, and certificate status query, and use digital certificates and various related services (such as certificate issuance, blacklist issuance, timestamp service, etc.) to achieve identity authentication, integrity, non-repudiation, and confidentiality of each entity in communication.

[0085] In a PKI system, a digital certificate is issued by a Certification Authority (CA) to bind the identity information and public key of a PKI user. A Relying Party can verify the certificate chain of the PKI user it communicates with based on the self-signed certificate of the root CA it trusts, so as to credibly obtain the public key of the user for various security services.

[0086] Generally, a complete PKI system should include parts such as digital certificates, CAs, certificate repositories, Certificate Revocation List (CRL) / Online Certificate Status Protocol (OCSP) systems, key backup and recovery systems, PKI application programming interface (API) systems, etc. The descriptions of each part are shown in Table 1:

[0087] Table 1

[0088]

[0089] 2. X.509 Certificate:

[0090] An X.509 certificate can refer to a digital certificate that complies with the X.509 standard. In one possible implementation, the information included in the X.509 certificate and the functions of each piece of information are shown in Table 2.

[0091] Table 2

[0092]

[0093] Among them, the subject name and subject alternative name can identify the identity information of the certificate holder. The subject name is the unique identifier used in the certificate to identify the certificate holder, usually including information such as the organization name, distinguish name, country / region (optional), etc., or including the host name, domain name, server (optional), etc. The subject name is the most important identifier in the certificate and is used to verify the authenticity and legality of the certificate. The subject alternative name is an alternative identifier for the subject name, usually including information such as the email address, internet protocol (IP) address, domain name system (DNS) name, etc. The role of the subject alternative name is to facilitate the use and management of the certificate, and the identity information of the certificate holder can be quickly located through the subject alternative name.

[0094] With the rapid development of smart hardware in various devices, as a representative of smart hardware, a smart camera can collect video and audio data and transmit the video and audio data over the network. To ensure the transmission security and privacy protection during the transmission process, referring to Figure 1 (A) in, related technologies can use the physical occlusion method outside the camera acquisition device body. In this way, when the camera is in a non-working state, the physical occlusion acts as the camera lens cover of the camera acquisition device, and the camera cannot capture video images, thus achieving the role of personal privacy protection. The above method first restricts the use of normal services during the process of privacy protection, and secondly, it cannot protect the audio information collected by the camera device. At the same time, when the subsequent occluded video and audio data are sent to the server, there may also be situations where they are intercepted or replaced, thus unable to ensure the security of its data transmission.

[0095] Referring to Figure 1In (B), in the related art, for the privacy area collected by the camera, manual delineation or delineation by intelligent algorithm detection can also be performed. Then, privacy protection processing is performed on the delineated area, so that the collected content of the delineated area can be changed, and operations such as encoding and outputting the processed video and audio data can be performed. However, delineating the area by the intelligent detection algorithm consumes a large amount of hardware of the device, and there are situations of false detection and missed detection. If the area is manually delineated, it needs to be delineated again after the position of the camera is adjusted, and there may also be a situation where privacy information appears outside the delineated area. Even if the processed video and audio data are sent to the server subsequently, there may also be a situation of being intercepted or replaced, thus unable to ensure the security of its data transmission.

[0096] See Figure 1 In (C), in the related art, the camera can also be used to send the collected user data to the server, and a data key is allocated and encrypted on the server side. Or the encryption key is sent from the server side to the camera, and the camera encrypts the data and uploads it to the server. However, in the above methods, the data key is controlled by the server, and the privacy information is exposed to the service provider uncontrollably. Similarly, if the data of the service provider is leaked, the security of the data transmission process and the privacy protection in the data cannot be guaranteed. In summary, how to ensure the security and privacy protection of data during network transmission while bringing a good user experience has become an urgent problem to be solved.

[0097] Based on the above content, an embodiment of the present application provides a data transmission method, which can be applied to a monitoring device. The monitoring device can encrypt a second key with a first key to obtain a third key. Among them, the first key is used to encrypt the second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data. The monitoring device can also encrypt the video and audio data with the second key to obtain encrypted data, and send a video and audio stream to the server. The video and audio stream includes the content identifier of the video and audio data, the third key, and the encrypted data.

[0098] The monitoring device provided by the embodiment of the present application can not only protect the second key with the first key, but also encrypt the video and audio data with the second key. During the process of sending the video stream, the monitoring device does not transmit the first key and the second key. In this way, the third key and the encrypted data cannot be cracked, so that it can be ensured that the video stream cannot be obtained or leaked during the transmission process, improving the security of data transmission and protecting the privacy in the data. Furthermore, the user experience is improved.

[0099] The present application provides a transmission system, and the above data transmission method can be applied to this transmission system. See Figure 2As shown, the transmission system includes an electronic device 20 and a monitoring device 21. Exemplarily, the electronic device 20 can be a device used by a user such as a mobile phone, and the monitoring device 21 can be an electronic device 20 with a camera used by the user. Among them, the electronic device 20 is used to control the monitoring device 21, view and share user data, etc., and the monitoring device 21 is used to collect user data, data encryption, etc.

[0100] In some embodiments of the present application, the above-mentioned electronic device 20 may include, but is not limited to, devices such as mobile phones, tablet computers, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), wearable devices, artificial intelligence (AI) devices, etc.

[0101] The monitoring device 21 includes a camera. For example, it includes, but is not limited to, devices such as surveillance camera devices, smart door locks, and smart door viewers. In some examples, the monitoring device 21 can also be other devices with a camera, such as mobile phones, tablet computers, laptop computers, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), wearable devices, in-vehicle devices, artificial intelligence (AI) devices, etc.

[0102] In some embodiments of the present application, the electronic device 20 can establish a communication connection with the monitoring device 21, and the communication connection includes a wired communication connection and a wireless communication connection. Among them, the wireless communication connection includes, but is not limited to, wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT) (for example, traditional Bluetooth or Bluetooth low energy (BLE)), near field communication (NFC), Zigbee, frequency modulation (FM), infrared (IR), etc.

[0103] In some embodiments, the above-mentioned electronic device 20 and monitoring device 21 can be fixed devices or portable devices. The operating systems installed on the electronic device 20 include, but are not limited to Or other operating systems. This application does not limit the specific types of the above-mentioned electronic device 20 and monitoring device 21, nor the operating systems installed on them.

[0104] In a possible implementation, as Figure 2 shown, the transmission system may further include a server 22 and a certificate authority 23. The server 22 is used to store user data, forward user data, and assist the certificate authority 23 in verifying device identities, etc. Exemplarily, the server 22 may be a hypertext transfer protocol (HTTP) server, or the server may be a domain name system (DNS) server.

[0105] In a possible implementation, the certificate authority 23 may be used for device authentication, digital certificate issuance, etc. For example, a certification authority (CA). It can be responsible for managing the entire life cycle of digital certificates, including issuing digital certificates, defining the validity period of digital certificates, revoking digital certificates, etc. Exemplarily, the CA may include a registration authority (RA), and the RA is used to obtain and authenticate the user identity and then submit a digital certificate issuance request to the CA. Among them, the RA may be a function integrated in the CA or deployed separately. It should be noted that the certificate in the embodiments of this application refers to a digital certificate. For the convenience of description, the digital certificate is simply referred to as a certificate in the embodiments of this application.

[0106] Among them, the electronic device 20 can communicate with the server 22 and the certificate authority 23 respectively. Among them, the communication between the electronic device 20 and the server 22 can be communication based on a wireless local area network or communication based on Long-Term Evolution (LTE). Also, the communication between the electronic device 20 and the certificate authority 23 can be communication based on a wireless local area network or communication based on LTE. Similarly, the monitoring device 21 can also communicate with the server 22 and the certificate authority 23 respectively.

[0107] In a possible implementation, as Figure 2 shown, the transmission system may further include a network device 24. The network device 24 may be a router, a switch, etc. The electronic device 20 and / or the monitoring device 21 can send user data to the server 22 through the network device 24. The electronic device 20 and / or the monitoring device 21 can be the starting point of user data transmission, and the server 22 can be the end point of user data transmission. It should be noted that the network device 24 is used to forward user data and does not process user data. For example, it does not perform the process of decrypting and then encrypting user data.

[0108] Among them, the network device 24 can establish a communication connection with the electronic device 20 and the monitoring device 21, and the specific manner of the communication connection will not be elaborated here. Of course, the network device 24 can also communicate with the server 22. Among them, the communication between the network device 24 and the server 22 can be communication based on a wireless local area network or communication based on Long Term Evolution (LTE).

[0109] In a possible implementation manner, the transmission system may further include a sharing device, and the sharing device may be an electronic device used by a third-party user. The user can share the video and audio data with the third-party user through the electronic device 20. For example, in a home scenario, mom can share the video and audio data collected by the monitoring device 21 with grandma. The third-party user can use their own sharing device to view the shared video and audio data.

[0110] The transmission system provided by the embodiments of the present application may further include other electronic devices in addition to the electronic device 20, the monitoring device 21, the network device 24, the server 22, the certificate center 23, and the sharing device. The transmission system provided by the embodiments of the present application includes, but is not limited to, interactions between the above-mentioned multiple devices, and may also be an interaction between one device and multiple devices. Those skilled in the art can determine the type and quantity of the devices according to actual needs, and these designs do not exceed the protection scope of the embodiments of the present application.

[0111] Exemplarily, taking the electronic device 20 as a mobile phone as an example, Figure 3 The structural schematic diagram of the mobile phone 100 is shown.

[0112] The mobile phone 100 may include a processor 110, an external memory interface 120, an internal memory 121, a Universal Serial Bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a headphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a Subscriber Identification Module (SIM) card interface 195, etc.

[0113] Among them, the sensor module 180 may include a pressure sensor 180A, a gyro sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, an image sensor 180M, etc.

[0114] It can be understood that the structure schematically shown in the embodiments of the present application does not constitute a specific limitation on the mobile phone. In other embodiments of the present application, the mobile phone may include more or fewer components than those shown in the figure, or combine certain components, or split certain components, or have different component arrangements. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0115] The processor 110 may include one or more processing units. For example, the processor 110 may include an Application Processor (AP), a modem processor, a Graphics Processing Unit (GPU), an Image Signal Processor (ISP), a controller, a video codec, a Digital Signal Processor (DSP), a baseband processor, and / or a Neural-network Processing Unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0116] The processor may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0117] A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments of the present application, the memory in the processor 110 may be a Cache. This memory may store instructions or data that have been used by the processor 110 or are used frequently. If the processor 110 needs to use this instruction or data, it can be directly called from this memory. This avoids repeated accesses, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0118] In some examples, the processor 110 can be used to receive a play operation for audio-visual data, send an audio-visual stream acquisition request, and receive the audio-visual stream sent by the server. The processor 110 can also be used to decrypt a third key according to a first key corresponding to the content identifier of the audio-visual data to obtain a second key. Then, the processor 110 can also be used to decrypt the encrypted data in the video stream with the second key and play the audio-visual data.

[0119] In other examples, the processor 110 can also be used to receive a sharing operation for audio-visual data, apply to the server for at least one shared device bound to the monitoring device and a third certificate of at least one shared device, and generate a license for at least one shared device based on the identification information and the third certificate of at least one shared device, so that the at least one shared device shares the audio-visual data with the mobile phone.

[0120] It can be understood that the connection relationship between the modules illustrated in the embodiments of the present application is only illustrative and does not constitute a structural limitation on the mobile phone. In other embodiments of the present application, the mobile phone can also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0121] In some embodiments of the present application, antenna 1 of the mobile phone is coupled to the mobile communication module 150, and antenna 2 is coupled to the wireless communication module 160, enabling the mobile phone to communicate with the network and other mobile phones through wireless communication technologies. The wireless communication technologies may include Global System For Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time-Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies, etc. The GNSS may include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS), and / or Satellite Based Augmentation Systems (SBAS).

[0122] The mobile phone 100 realizes the display function through the GPU, the display screen 194, and the application processor, etc. The GPU is a microprocessor for image processing, connected to the display screen 194 and the application processor. The GPU is used to execute mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change the display information.

[0123] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. In some embodiments, the mobile phone 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0124] In some other embodiments, the display screen 194 may also be used to display prompt information for prompting the bound mobile phone and the monitoring device.

[0125] The camera 193 is used to capture static images or videos. An object generates an optical image through a lens and projects it onto a photosensitive element. The photosensitive element can be a Charge Coupled Device (CCD) or a Complementary Metal-Oxide-Semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transfers the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard format such as RGB or YUV. In some embodiments, the mobile phone 100 may include one or N cameras 193, where N is a positive integer greater than 1.

[0126] Here, the camera 193 can be disposed in the mobile phone 100. Of course, it can also be a part of an electronic device. In some implementation manners, the camera can also be disposed outside the electronic device and connected to the electronic device in a wired or wireless manner. For example, the camera can be connected to the electronic device through Bluetooth or a mobile hotspot. The electronic device can control the camera by sending or receiving instructions to the camera.

[0127] The camera 193 may further include a camera module, and the camera module can be disposed inside the camera. Of course, it can also be disposed at other positions inside the mobile phone 100. The camera module includes a lens, a focusing motor, a base, a circuit board, and a photosensitive element.

[0128] The base is fixedly connected to one side of the circuit board. The focusing motor is located on the side of the base away from the circuit board and fixedly connected to the periphery of the base. The lens is mounted in the middle of the focusing motor. The photosensitive element is fixed to the side of the circuit board facing the lens.

[0129] The lens is used to collect the optical signal reflected by the object to be photographed. The focusing motor is used to drive the lens to move along the direction parallel to the optical axis. The optical axis refers to the line passing through the center of the lens. In some embodiments, the mobile phone 100 can control the focusing motor to move the lens to the focusing position, thereby completing the focusing process.

[0130] In some embodiments, the focusing motor can be a voice coil motor (VCM), a shape memory alloy (SMA) motor, a piezo motor (PM), a stepper motor (STM), etc.

[0131] In some embodiments of the present application, the camera 193 may further include an AI processor. In one implementable manner, the AI processor may be used to collect user data and encrypt and decrypt the collected user data, etc.

[0132] In some embodiments, the image sensor 180M may be used to detect objects within the range captured by the camera. Each photosensitive unit corresponds to a pixel in the image sensor. The image sensor 180M may include a first color (red green blue, RGB) image sensor, a second color (red yellow blue, RYB) image sensor, a black-and-white image sensor, an infrared image sensor, etc. The embodiments of the present application do not make any limitations in this regard. The image sensor 180M is used to collect images within the range captured by the camera 193, where the images may include RGB images, RYB images, black-and-white images, infrared images, etc.

[0133] The above-mentioned image sensor 180M may also be disposed in one or several cameras 193. The embodiments of the present application do not specifically limit the component arrangement.

[0134] Taking the monitoring device as a camera as an example, Figure 4 shows a schematic structural diagram of the camera.

[0135] As Figure 4 shown, the camera may include a processor 410 and a memory 420.

[0136] It can be understood that the structure schematically shown in the embodiments of the present application does not constitute a specific limitation on the camera 400. In other embodiments of the present application, the camera 400 may include more or fewer components than shown, or combine certain components, or split certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0137] The processor 410 may include one or more processing units. For example, the processor 410 may include an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0138] The memory 420 may include a computer system readable medium in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The memory 420 may include at least one program product having a set (e.g., at least one) of program modules configured to execute the methods provided by the embodiments of the present application. The program / utility with a set (at least one) of program modules may be stored in the memory 420, and such program modules include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment. The program modules generally execute the functions and / or methods in the embodiments described in the present application.

[0139] The processor 410 executes various functional applications and data processing by running the programs stored in the memory 420, such as implementing the data transmission method in the camera provided by the embodiments shown in the present application. Further, the camera 400 may further include a lens 430, a photosensitive element 440, and a communication interface 450. An object generates an optical image through the lens 430 and projects it onto the photosensitive element 440. The photosensitive element 440 may be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element 440 converts the optical signal into an electrical signal, and then transmits the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into a standard image signal in formats such as RGB and YUV.

[0140] In some embodiments of the present application, the communication interface 450 is used for the interaction between the camera 400, an electronic device, a server, and a certificate authority. The memory 420 may store the collected video and audio data.

[0141] In some implementations of the present application, the processor 410 may execute a key negotiation process to generate a first key, and the first key is used to encrypt a second key corresponding to the video and audio data. The processor 410 may also be used to generate a second key, and encrypt the second key using the first key to obtain a third key. The processor 410 may also encrypt the video and audio data using the second key to obtain encrypted data, and send a video and audio stream to the server.

[0142] Exemplarily, only a mobile phone is used to illustrate the structures of the electronic device and the monitoring device in the embodiments of the present application, but it does not constitute a limitation on the structures and forms of the electronic device and the monitoring device. The embodiments of the present application do not limit the structures and forms of the electronic device and the monitoring device.

[0143] In some embodiments of the present application, the camera in the monitoring device can also be set in the electronic device, and the two devices, the electronic device and the monitoring device, can implement the data transmission method provided in the embodiments of the present application. Of course, the electronic device can also independently implement the data transmission method provided in the embodiments of the present application.

[0144] In some examples, for the structures of the sharing device and the forwarding device, reference can be made to the implementation of the above-mentioned electronic device and monitoring device. Optionally, the sharing device and the forwarding device may include more or fewer components than Figure 3 or Figure 4 shown, or combine certain components, or split certain components, or replace certain components, or have different component arrangements. The illustrated components can be implemented in hardware, software, or a combination of software and hardware.

[0145] Next, the method provided in the embodiments of the present application will be described in detail in conjunction with the accompanying drawings and the above description. In the embodiments of the present application, each entity can execute some or all of the steps in the embodiments of the present application. These steps or operations are only examples, and the embodiments of the present application can also execute other operations or various deformations of the operations. In addition, each step can be executed in a different order presented in the embodiments of the present application, and it is possible not to execute all the operations in the embodiments of the present application.

[0146] Next, a mobile phone will be taken as an example of the electronic device and a CA will be taken as an example of the certificate center for elaboration.

[0147] In some embodiments of the present application, in the scenario where a user uses a monitoring device, the user can control the monitoring device through their own mobile phone. For example, view the audio and video data collected by the monitoring device in real time, review and share the audio and video data collected by the monitoring device, and so on. The monitoring device itself can store the collected audio and video data in the server, facilitating the user to process the audio and video data through the mobile phone. During the process of sending the collected audio and video data to the server, the monitoring device needs to encrypt the audio and video data, and the mobile phone needs to manage the encryption key of the monitoring device.

[0148] Generally, a target application for implementing the management of the monitoring device can be installed in the mobile phone, and the mobile phone can control the monitoring device through this target application. In some examples, the target application includes, but is not limited to, a monitoring application corresponding to the monitoring device, a home application, and so on. For example, when the monitoring device is a smart cat's eye, the target application can be a smart life application. Similarly, a camera application can also be installed in the monitoring device, and the camera application can be used to implement the collection, encryption processing, and self-key management of the audio and video data. The embodiments of the present application do not specifically limit the specific application types and application implementation forms of the above applications.

[0149] Before the mobile phone manages the encryption key for the monitoring device and the monitoring device sends video and audio data to the server, the mobile phone needs to authenticate and bind with the monitoring device. After the user starts the target application in the mobile phone and powers on and configures the network for the monitoring device, the target application and the camera application need to perform authentication. Specifically, the target application and the camera application need to complete certificate download and execute the binding process between the mobile phone and the monitoring device.

[0150] In some embodiments of the present application, after the user installs the monitoring device, the user can use the target application in the mobile phone to establish a communication connection and bind with the monitoring device.

[0151] Exemplarily, take the smart life application in the mobile phone as an example. The user can add a monitoring device in the smart life application of the mobile phone to implement the binding and device registration process. Figure 5 Schematic diagram of an add device interface provided by an embodiment of the present application. As Figure 5 shown in (A) therein, it is a front view schematic diagram of the mobile phone provided by an embodiment of the present application. The display screen of the mobile phone displays a smart life application icon 500. The user can click on the smart life application icon 500. As Figure 5 shown in (B) therein, in response to the click operation on the smart life application icon, the mobile phone displays the user interface of the smart life application. The user interface may include pre-configured scene names, devices at home, and corresponding status information, etc. For example, the devices at home and corresponding status information include the TV in the living room (online), the TV in the master bedroom (online), and the stereo in the master bedroom (offline), etc. The pre-configured scene names include the homecoming scene, the sleep scene, and the leaving home scene, etc. The user interface may also include icons of the configured devices.

[0152] It can be understood that the configured devices can be devices associated with the user account. The user needs to log in to the corresponding user account in the smart life application. And the devices pre-configured by the user need to be bound to the user account to complete the configuration. If the user has not logged in to the smart life application, the user needs to log in to the corresponding user account and enter the username and password.

[0153] Continue to refer to Figure 5 (B) therein. The user can also click on the "+" icon on the user interface to add devices and create a scene with one key, etc. For example, as Figure 5 shown in (C) therein, after the user clicks on the "+" icon, in response to the user's click operation, the mobile phone controls the display screen to show a drop-down menu. The drop-down menu includes an add device control 501, a share device control 502, a create scene control 503, and a connect to a third-party platform control 504. The user can click on the pre-configured add device control 501 in the drop-down menu to trigger entering the add device interface. As Figure 5As shown in (D), the mobile phone displays an add device interface in response to the user's operation of clicking the add device control 501.

[0154] Specifically, the mobile phone sends a scan request in response to the user's click operation on the add device control 501. This scan request is used to scan the monitoring devices near the mobile phone that are in a Bluetooth connectable state. For example, the scan request may include the Bluetooth address of the mobile phone. During the process of the mobile phone searching for nearby monitoring devices, the monitoring devices can send broadcast data packets. Among them, the monitoring devices can send broadcast data packets through the internal Bluetooth module. This broadcast data packet can be used for the monitoring devices to broadcast to nearby devices that their Bluetooth is in a connectable state. The broadcast data packet may contain the Bluetooth address of the monitoring device. When the mobile phone receives the broadcast data packet from the monitoring device, it displays the information corresponding to the monitoring device in the add device interface.

[0155] Continue to refer to Figure 5 In (D), the add device interface includes the device name of the device to be added, the connection control 505, the rescan control, the manual add control corresponding to the manual add method, and the scan code add control corresponding to the scan code add method. For example, the user can click the connection control 505 corresponding to the monitoring device to perform Bluetooth binding. In this way, the mobile phone displays the corresponding connection interface and sends a Bluetooth binding request to the monitoring device corresponding to the connection control 505 in response to the user's click operation on the connection control 505 to achieve Bluetooth binding with the monitoring device.

[0156] Refer to Figure 6 In (A), the connection interface includes a WLAN name display box 601a, a WLAN password display box 601b, a pairing code display box 602, and a next step control. The WLAN name display box 601a is used to display the WLAN name, the WLAN password display box 601b is used to display the WLAN password, and the pairing code display box 602 is used to display the pairing code to be used for Bluetooth binding. For example, the pairing code is 123456. The user can select the correct WLAN name, enter the correct WLAN password, and obtain the pairing code.

[0157] Refer to Figure 6 In (B), the user needs to select the WLAN name in the connection interface, enter the corresponding WLAN password, and enter the pairing code in the pairing code input box. Then, the user can check the box indicating that the pairing code has been entered and click the next step control to trigger the mobile phone to send a connection instruction to the monitoring device to achieve the communication connection between the mobile phone and the monitoring device.

[0158] In some embodiments of the present application, in response to a user's click operation on the next control, the mobile phone may also send an association request and association information to the server. Then the server receives the association request and association information sent by the mobile phone and binds the mobile phone to the monitoring device.

[0159] It should be noted that during the process of the monitoring device establishing a communication connection with the server, the communication connection can be established via a router. The router can provide network access services for the devices connected to itself, that is, the mobile phone and the monitoring device can be connected through the router to access the same network (such as the same home WLAN). The mobile phone and the monitoring device can also be connected through the router to access the server. Of course, the data transmitted through the WLAN communication connection between the mobile phone and the monitoring device can be relayed by the router to the other end, or can be directly transmitted without passing through the router.

[0160] It can be understood that Figure 5 、 Figure 6 This is only an example of the communication connection and binding between the mobile phone and the monitoring device provided by the present application, and should not limit the present application.

[0161] During the process of the above-mentioned mobile phone establishing a communication connection with the monitoring device and the mobile phone sending an association request and association information to the server, the monitoring device can apply for a first certificate from the CA according to its own first public key, and the first certificate is used for binding between the mobile phone and the monitoring device.

[0162] For the specific process, refer to Figure 7 , the method includes:

[0163] Step 701: The monitoring device generates a first public-private key pair.

[0164] Step 702: The monitoring device sends a first certificate acquisition request to the CA.

[0165] Step 703: The CA receives the first certificate acquisition request from the monitoring device and sends the first certificate to the monitoring device according to the first certificate acquisition request.

[0166] In some embodiments of the present application, after the monitoring device is powered on, it can pre-detect the first certificate locally. In the case that the monitoring device does not have the first certificate locally, it can generate a first public-private key pair and send a first certificate acquisition request to the CA. The CA receives the first certificate acquisition request from the monitoring device and sends the first certificate to the monitoring device according to the first certificate acquisition request. Then, the monitoring device can receive the first certificate sent by the CA.

[0167] Among them, the first certificate acquisition request may include the identification information of the monitoring device, the first public key in the first public-private key pair, and the algorithm information corresponding to the first public key. The first certificate may include the name corresponding to the certificate holder monitoring device, the first public key corresponding to the monitoring device, the certificate validity period, and the certificate signature, etc.

[0168] In some examples, the monitoring device may generate a first public-private key pair using an asymmetric algorithm, and the first public-private key pair is an asymmetric key pair. Among them, the first public-private key pair includes a first public key and a first private key. The first public key is a public key, and the first private key is a private key. The first public key is used for encryption, and the first private key is used for decryption. The ciphertext obtained after encryption using the first public key can only be decrypted with the corresponding first private key to obtain the original plaintext.

[0169] For example, the asymmetric algorithm may include but is not limited to the SM2 algorithm, the RSA (Ron Rivest, Adi Shamir, Leonard Adleman) algorithm, Elgamal, the knapsack algorithm, Rabin, D-H, and the ECC (Elliptic Curve Cryptography) elliptic curve algorithm.

[0170] In some examples, the identification information of the monitoring device may be any identification information used to identify the identity of the monitoring device. For example: the user account logged in to the monitoring device, the monitoring device name such as "monitoring device", the preset value corresponding to the monitoring device, the MAC address of the monitoring device, the hardware number of the monitoring device, or the string generated by the system. For example, it may be the international mobile equipment identity (IMEI), mobile equipment identifier (MEID), serial number (SN), version number of the device system, and version number of the application in the device, etc., one or more pieces of plaintext or encrypted information. Or, the identification information of the monitoring device may also be a preset encrypted field, a preset encrypted value, and a preset encrypted binary string, etc.

[0171] In some embodiments of the present application, the mobile phone may also apply for a second certificate from the CA according to its own second public key; the second certificate is used for binding the mobile phone to the monitoring device. The specific steps are as follows:

[0172] Step 704: The mobile phone generates a second public-private key pair.

[0173] Step 705: The mobile phone sends a second certificate acquisition request to the CA.

[0174] Among them, the second certificate acquisition request may include the identification information of the mobile phone, the second public key in the second public-private key pair, and algorithm information.

[0175] Step 706: The CA receives the second certificate acquisition request from the mobile phone and sends the second certificate to the mobile phone according to the second certificate acquisition request.

[0176] In some embodiments of the present application, the mobile phone can also execute the certificate online download process, and the mobile phone can also request the second certificate from the CA. Specifically, the mobile phone pre-detects the second certificate locally. When the mobile phone does not have the second certificate locally, it can generate a second public-private key pair and send a second certificate acquisition request to the CA. The CA receives the second certificate acquisition request from the mobile phone and sends the second certificate to the mobile phone according to the second certificate acquisition request. Then, the mobile phone can receive the second certificate sent by the CA.

[0177] Among them, the second certificate acquisition request is used to request the second certificate corresponding to the mobile phone. The second certificate acquisition request includes the identification information of the mobile phone, the second public key in the second public-private key pair, and the algorithm information corresponding to the second public key; the second certificate may include the name corresponding to the certificate holder's mobile phone, the first public key corresponding to the mobile phone, the certificate validity period, the certificate signature, etc.

[0178] In some examples, the mobile phone can generate a second public-private key pair using an asymmetric algorithm, and the second public-private key pair is an asymmetric key pair.

[0179] Similarly, the identification information of the mobile phone can be any identification information used to identify the identity of the mobile phone, such as the user account logged in to the mobile phone, etc., which will not be elaborated here.

[0180] It should be noted that the embodiments of the present application do not specifically limit the specific generation method of the public-private key pair, the algorithm information, the request information included in the certificate acquisition request, and the certificate information included in the certificate.

[0181] In this way, the monitoring device can apply for the first certificate from the certificate center according to the first public key generated by itself, so as to facilitate subsequent identity verification and data communication with the electronic device using the first certificate. Similarly, the mobile phone can also apply for the second certificate from the certificate center according to the second public key generated by itself, so as to facilitate subsequent identity verification and data communication with the monitoring device using the second certificate. In this way, the interactivity between the two devices can be improved. Furthermore, the user can control the monitoring device through the electronic device, enhancing the interactivity between the user, the electronic device, and the monitoring device, and improving the user experience.

[0182] Step 707: The mobile phone sends a certificate exchange request.

[0183] Step 708: The monitoring device receives the certificate exchange request and sends the first certificate and the identification information of the monitoring device to the mobile phone.

[0184] Step 709: The mobile phone receives the first certificate and the identification information of the monitoring device sent by the monitoring device, and sends an association request and association information to the server.

[0185] Step 710: The server binds the mobile phone to the monitoring device according to the association request and the association information.

[0186] In some embodiments of the present application, the above-mentioned mobile phone and monitoring device respectively perform a certificate download process. After the mobile phone and the monitoring device obtain their own certificates, they can perform certificate exchange so that both parties can verify each other's identities. Furthermore, the subsequent data communication process can be realized. Then, through the certificate exchange between the two parties, the mobile phone can send its own identification, certificate, and the corresponding identification and certificate of the monitoring device to the server to complete the binding process.

[0187] Specifically, the mobile phone can send a certificate exchange request to the monitoring device. The certificate exchange request is used to request the first certificate corresponding to the monitoring device. The monitoring device receives the certificate exchange request and sends the first certificate and the identification information of the monitoring device to the mobile phone. The mobile phone receives the first certificate and the identification information of the monitoring device sent by the monitoring device, and sends an association request and association information to the server. Among them, the association request is used to request the server to bind the mobile phone and the monitoring device, and the association information includes the first certificate, the identification information of the monitoring device, the second certificate, and the identification information of the mobile phone. The server binds the mobile phone and the monitoring device according to the association request and the association information, and stores the binding information between the mobile phone and the monitoring device.

[0188] In some embodiments of the present application, the server can also send the second certificate and the identification information of the mobile phone to the monitoring device so that the monitoring device can obtain the certificate and identification information corresponding to the bound device, thereby completing the identity verification.

[0189] Based on the above process, the mutually communicating mobile phone and monitoring device respectively apply for certificates from the CA and are bound by the cloud after the certificate exchange. When the two devices perform the certificate exchange, the two applications (smart life application and camera application) on the two devices are both verified successfully. That is, the mobile phone trusts the camera application on the monitoring device, and the monitoring device trusts the smart life application on the mobile phone. Then, the server binds the two devices, and the two devices can share the data between the applications, thereby realizing the communication between the applications across devices. In this way, there is no need for the user to participate in the complex verification and binding process, improving the convenience of user operation and ensuring the user experience.

[0190] In some embodiments of the present application, the server may also send a binding success response to the mobile phone. The mobile phone can receive the binding success response sent by the server and output a prompt message according to the binding success response. The prompt message is used to prompt that the mobile phone and the monitoring device have been bound. Furthermore, the interactivity between the user and the mobile phone and the flexibility of the binding process are improved.

[0191] Among them, the prompt message may include one or more of a pop-up prompt message, a text prompt message, a voice prompt message, or a video prompt message.

[0192] Exemplarily, referring to Figure 8 , the mobile phone can also display the prompt message on the current display interface, and the prompt message can be implemented as the text "The monitoring device has been bound". Of course, the mobile phone can also control the speaker to play the prompt message, and the prompt message can be implemented as a prompt tone such as "The monitoring device has been bound".

[0193] The mobile phone can give the user a binding success prompt, prompting the user that the electronic device and the monitoring device have successfully established a binding relationship. It can provide a more user-friendly function for the user and improve the interactivity between the user and the electronic device.

[0194] In some embodiments of the present application, after the mobile phone and the monitoring device establish a binding relationship, the monitoring device can encrypt and store the collected user data, generate an encryption key during the encryption process, and the server will not obtain the encryption key.

[0195] Specifically, the smart life application can negotiate a key with the camera application to generate a first key. Similarly, the camera application can negotiate a key with the smart life application to derive a first key and randomly generate a second key. In this way, the camera application can use the second key to encrypt the video and audio data to obtain encrypted data. The camera application can also use the first key to encrypt the second key to obtain a third key. Thus, the camera application can send a video and audio stream to the server, and the video and audio stream includes the third key, the encrypted data, and the content identifier corresponding to the video and audio data.

[0196] In this way, after the server receives the video and audio stream, it cannot obtain the first key and cannot decrypt the third key either. Furthermore, it can not only protect the privacy information in the video and audio data, but also improve the transmission security during the transmission process.

[0197] In some embodiments of the present application, after the mobile phone and the monitoring device are bound, the mobile phone can manage the generation and update of the corresponding key of the monitoring device. In this way, the monitoring device can encrypt and send the collected video and audio data after generating the key.

[0198] In some examples, such as Figure 9As shown, the process of the mobile phone controlling the monitoring device to generate a key and encrypt and send audio and video data may include the following steps:

[0199] Step 901: The mobile phone negotiates a key with the monitoring device to generate a first key.

[0200] Step 902: The mobile phone sends the content identifier of the audio and video data to the monitoring device.

[0201] In some embodiments of the present application, the mobile phone can control the generation and update of the first key. The mobile phone can generate the content identifier of the audio and video data, negotiate a key with the monitoring device to generate a first key, and can also send the content identifier of the audio and video data to the monitoring device. The content identifier of the audio and video data is used for the monitoring device to establish a correspondence between the generated first key and the content identifier.

[0202] Among them, the content identifier of the audio and video data is used to identify the identity information of the audio and video data. The content identifier of the audio and video data includes the stream name, stream ID, preset value, or system-generated string corresponding to the audio and video stream of the audio and video data, etc. Of course, the content identifier of the audio and video data can also be a preset encryption field, a preset encryption value, and a preset encryption binary string, etc.

[0203] In some embodiments, the mobile phone and the monitoring device can interact based on the ECDHE protocol to complete the key negotiation. The ECDHE protocol is a Diffie-Hellman (DH) key negotiation protocol using an elliptic curve signcryption scheme (Elliptic Curve, EC). Through the key negotiation, the mobile phone can negotiate a shared key with the monitoring device.

[0204] Exemplarily, the mobile phone can generate a first random number, and generate a first shared private key and a first shared public key. The mobile phone sends an authentication exchange message (i.e., AKE_AUTHKEY_EXCHANGE message) to the monitoring room in a combined manner, and the first random number and the shared public key are carried in the authentication exchange message. After receiving the authentication exchange message, the monitoring device generates a second random number, a second shared private key, a second shared public key, and a shared secret key. The monitoring device can also generate a signature using a signature algorithm (sign algorithm) and an authentication code using a hash-based message authentication code algorithm. Then, the monitoring device sends an authentication response message (i.e., AKE_AUTHKEY_ACK message) to the mobile phone, and the authentication message includes the second random number, the first certificate, the second certificate, the second shared public key, the signature, and the authentication code. In this way, after receiving the authentication response message, the mobile phone verifies the certificate of the monitoring device, generates a shared password, and verifies the signature and the authentication code. Finally, after successful authentication, the mobile phone sends an authentication confirmation message (i.e., AKE_AUTHKEY_CONFIRM) to the monitoring device, and the authentication confirmation message includes a confirmation code. After receiving the authentication confirmation message, the monitoring device verifies the confirmation code. Furthermore, the two devices complete the key negotiation process. Specifically, for the mobile phone, the shared secret key, the first random number, and the second random number can be obtained, and for the monitoring device, the shared secret key, the first random number, and the second random number can be obtained. In this way, the subsequent mobile phone and the monitoring device can derive the same first key using the shared secret key, the first random number, and the second random number.

[0205] It should be noted that the shared secret key generated by the mobile phone is the same as the shared secret key generated by the above-mentioned monitoring device. The above key negotiation process is only for exemplary illustration, and the embodiments of the present application do not limit the specific implementation manner of key negotiation.

[0206] Step 903: The monitoring device and the mobile phone perform key negotiation to generate a first key, and the first key is used to encrypt a second key corresponding to the video and audio data.

[0207] Step 904: The monitoring device generates a second key, and encrypts the second key using the first key to obtain a third key; the second key is used to encrypt the video and audio data.

[0208] Step 905: The monitoring device encrypts the video and audio data using the second key to obtain encrypted data.

[0209] Step 906: The monitoring device sends a video and audio stream to the server, and the video and audio stream includes the content identifier of the video and audio data, the third key, and the encrypted data.

[0210] In some embodiments of the present application, after the mobile phone and the monitoring device complete the key negotiation process, both parties can derive a first key based on the key negotiation process, and the two devices can also store the derived first key. During the process of deriving the first key, the monitoring device can randomly generate a second key and encrypt the second key using the first key to obtain a third key. The monitoring device can also encrypt the video and audio data using the second key to obtain encrypted data. In this way, the monitoring device can send a video and audio stream to the server, and the video and audio stream includes the content identifier of the video and audio data, the third key, and the encrypted data.

[0211] Among them, the above-mentioned first key and second key can be symmetric encryption keys. The monitoring device can generate the first key and the second key using a symmetric encryption algorithm and encrypt the second key based on the first key. Exemplarily, the symmetric encryption algorithm can be the AES encryption algorithm.

[0212] By encrypting the second key with the first key, it is possible to protect the second key using the first key, which can prevent unauthorized personnel or systems from reading or modifying the encrypted video and audio data. Only authorized entities can decrypt and access the encrypted video and audio data. The video and audio data may contain personal, commercial, or confidential privacy data. In this way, not only can the video and audio data be encrypted using the second key, but also the second key can be encrypted using the first key, which can ensure that the video and audio data will not be obtained or leaked during the transmission process. At the same time, the monitoring device does not transmit the first key and the second key, and the server side cannot obtain the first key and the second key. The third key and the encrypted data cannot be cracked during the transmission process, improving the transmission security of the data transmission and protecting the privacy information. Furthermore, the user experience is improved.

[0213] It should be noted that the AES encryption algorithm is only one embodiment of the present application, and it may also include the SM4 encryption algorithm, etc. Any method of encrypting data through an encryption algorithm belongs to the protection scope of the present application.

[0214] In some embodiments of the present application, the monitoring device can collect video and audio data in real time and send a video and audio stream to the server. The monitoring device can also collect video and audio data at periodic intervals and send a video and audio stream to the server. For example, during the process of collecting and sending the video and audio stream, the monitoring device can encrypt the video and audio data every 60s after collection and send it to the corresponding video and audio stream of the server.

[0215] In some embodiments of the present application, in order to improve the transmission security and privacy protection of video and audio streams, different video and audio streams may use different first keys, or a preset number of video and audio streams may use the same first key. In the embodiments of the present application, the mobile phone may update its own first key and the first key in the monitoring device at periodic intervals of a certain duration. For example, the mobile phone may carry different random numbers each time it initiates a key negotiation process to the monitoring device. For another example, the mobile phone may also send a key negotiation update process to the monitoring device every day.

[0216] In some other embodiments of the present application, the mobile phone needs to update the first key based on a preset rule. The preset rule includes that the usage duration of the first key exceeds a preset duration or the number of video streams encrypted using the first key exceeds a preset number. For example, the usage duration of the first key exceeds 72 hours, or the number of video streams encrypted using the first key exceeds 2000.

[0217] It should be noted that the key negotiation update process is similar to the above key negotiation process and will not be elaborated here. Of course, the above key negotiation process is only for illustrative purposes, and the embodiments of the present application do not limit the specific process implementation.

[0218] In some embodiments of the present application, the user can view and review video and audio data in real time through the Smart Life application in the mobile phone. The mobile phone can detect the user's viewing operation, download the video and audio stream from the server, and decrypt the third key in the video and audio stream using the local first key to obtain the second key. The mobile phone can also decrypt the encrypted data using the second key to obtain the video and audio data. Furthermore, the decoding and playback of the video and audio data are completed.

[0219] In one implementable manner, the mobile phone can receive a trigger operation of the user for a target application, display a to-be-played interface, and the to-be-played interface includes at least one video and audio data. The mobile phone receives the user's play operation for the video and audio data and plays the video and audio data.

[0220] Exemplarily, referring to Figure 10 in (A), the user can use the view data function in the device management interface of the monitoring device. The device management interface includes a device icon corresponding to the monitoring device, a device status, a function area, and a record area. The function area includes a user management control, a view data control, a power management control, and a more function control. The user can click the view data control to trigger entering the to-be-played interface. The mobile phone detects the user's click operation on the view data control and displays the to-be-played interface.

[0221] Figure 10 In (B) is a schematic diagram of a to-be-played interface provided by the embodiments of the present application. Referring to Figure 10In (B) thereof, the playback interface includes data controls corresponding to the collected video and audio data and function controls corresponding to the video and audio data. The user can click on the data controls to trigger entry into the playback window to implement the playback of the selected video and audio data. The mobile phone can receive the user's playback operation on the video and audio data (i.e., the selection operation on the data controls) and play the corresponding video and audio data.

[0222] In some embodiments of the present application, referring to Figure 11 , during the process of the mobile phone playing the video and audio data, the mobile phone can receive the user's playback operation on the video and audio data and send a video and audio stream acquisition request to the server (step 1101). The video and audio stream acquisition request may include the content identifier of the video and audio data. Based on the video and audio stream acquisition request, the server sends the video and audio stream corresponding to the content identifier of the video and audio data to the mobile phone (step 1102). The mobile phone receives the video and audio stream sent by the server. The video and audio stream includes the content identifier of the video and audio data, the third key, and encrypted data. The encrypted data is encrypted by the second key, and the third key is obtained by encrypting the second key with the first key. In this way, the mobile phone can decrypt the third key according to the first key corresponding to the content identifier of the video and audio data to obtain the second key. Specifically, the mobile phone can parse the video stream to obtain the content identifier of the video and audio data (step 1103). The mobile phone can also search for the first key corresponding to the content identifier of the video and audio data according to the content identifier of the video and audio data (step 1104), and decrypt the third key with the first key to obtain the second key (step 1105). Then, the mobile phone can also decrypt the encrypted data with the second key to obtain the video and audio data and play the video and audio data (step 1106).

[0223] In the above scenario where the user monitors and reviews the video and audio data in real time, the first key is stored locally on the mobile phone, and the mobile phone can directly obtain the video and audio stream from the server and decrypt it with the first key to complete the playback of the video and audio data. In this way, the user can view and review the video and audio data collected by the monitoring device through the electronic device in real time, which can provide more user-friendly functions and improve the interactivity between the user and the electronic device. In addition, during the process of the user watching the video and audio data, the embodiments of the present application can decrypt the video and audio stream using a unique first key, that is, different video and audio streams can be decrypted using different first keys, further enhancing the security of the video and audio stream transmission.

[0224] Embodiments of the present application also support users to share the video and audio data collected by the monitoring device with other third-party users, so that other third-party users can watch the video and audio data through their own shared devices. Exemplarily, in the scenario of smart home, the administrator user is mom. Mom binds the smart life application in her own mobile phone with the camera application in the monitoring device. Mom can monitor and review the video and audio data collected by the monitoring device in real time at any time. At the same time, mom can also share the video and audio data with other third-party family members such as grandma, so that grandma can use the application program in the shared device to watch the video and audio data shared by mom.

[0225] In the above sharing scenario, in order to protect the privacy of the video and audio data and restrict the third-party users, the mobile phone can generate an authorization license for the shared device by obtaining the certificate of the third-party user using the shared device. In this way, on the premise of successful license authorization, the shared device can use its own private key to decrypt the first key in the license and use the first key to decrypt the third key to obtain the second key. Then, use the second key to decrypt the encrypted data to complete the decoding and playing of the video and audio data. Of course, the smart life application can also be installed in the shared device.

[0226] It should be noted that in the above sharing scenario, after at least one third-party user starts at least one shared device, at least one shared device can generate a third public-private key pair, which includes a third public key and a third private key, and send a third certificate acquisition request to the CA to receive the third certificate sent by the CA. Of course, at least one shared device can also execute the binding process with the monitoring device, such as sending an association request and association information to the server. For the specific certificate download process and device binding process, please refer to the above, and will not be elaborated here.

[0227] In some examples, continue to refer to Figure 10 (B) in, the playback interface includes data controls corresponding to the collected video and audio data and function controls corresponding to the video and audio data. The user can click on the function control to trigger the entry into the sharing interface to achieve the sharing of the selected video and audio data. Refer to Figure 12 , the mobile phone displays a sharing interface in response to the user's click operation on the function control. The sharing interface includes identification information corresponding to at least one shared device. The user can perform a selection operation on the identification information corresponding to at least one shared device to trigger the process of generating a license corresponding to at least one shared device, so that at least one shared device can play the video and audio data collected by the monitoring device subsequently.

[0228] Exemplarily, the user can perform a selection operation on user A to trigger the generation of a license for the device corresponding to user A, so that the device corresponding to user A can play the video and audio data collected by the monitoring device subsequently.

[0229] In some embodiments of the application, the mobile phone can receive a sharing operation for audio-visual data, and apply to the server for at least one shared device bound to the monitoring device and a third certificate of at least one shared device. The mobile phone can also generate a license for at least one shared device based on the identification information of at least one shared device and the third certificate. Then, the mobile phone sends the license of at least one shared device to the server, and the license is used for the at least one shared device to share audio-visual data with the mobile phone.

[0230] Specifically, referring to Figure 13 , the mobile phone can receive a sharing operation for audio-visual data by the user, that is, the above-mentioned selection operation for the identification information corresponding to at least one shared device, and send a device acquisition request (step 1301) to the server. The device acquisition request is used to request to acquire at least one shared device bound to the monitoring device and a third certificate of at least one shared device. Among them, the device acquisition request may include the identification information of the monitoring device. Exemplarily, the mobile phone acquires a user list bound to the monitoring device from the server, and the server returns the user list according to the binding information bound to the monitoring device. The user list includes a third certificate of at least one shared device bound to the monitoring device and expression information of at least one shared device, etc.

[0231] It should be noted that the mobile phone can also acquire at least one shared device bound to the monitoring device from the server and apply for a third certificate corresponding to at least one shared device from the CA.

[0232] During the sharing process, the mobile phone needs to determine the identity of the device to be shared. After the mobile phone acquires the third certificate of at least one shared device and the verification is successful, the subsequent process of generating a license for at least one shared device can be executed.

[0233] Then, the server sends the identification information and the third certificate of at least one shared device to the mobile phone (step 1302). The mobile phone can generate a license for at least one shared device based on the identification information and the third certificate of at least one shared device (step 1303), and send the license of at least one shared device to the server (step 1304). During the process of receiving the license of at least one shared device, the server can send a save result to the mobile phone (step 1305) to notify the mobile phone that the license of at least one shared device has been saved. In some examples, the server can also send the license of at least one shared device to at least one shared device, so that at least one shared device shares audio-visual data with the mobile phone according to the license.

[0234] In some embodiments of the present application, when the mobile phone generates a license for at least one shared device based on the identification information of the at least one shared device and the third certificate, the mobile phone may encrypt the first key with the third public key in the third certificate to obtain a fourth key. The mobile phone generates a first signature using the second private key in the second public-private key pair. Then, the mobile phone generates a license for at least one shared device according to the fourth key, the first signature, and the identification information of the at least one shared device.

[0235] In some embodiments of the present application, during the process of the mobile phone generating a license for at least one shared device, there is a corresponding relationship between the first key in the license and the content identifier of the audio-visual data. The license may correspond to at least one shared device and may also correspond to audio-visual data. Different audio-visual data may each correspond to a different license, and each license corresponds to at least one shared device. It can be understood that the mobile phone may also generate a license for the audio-visual data based on the identification information of the at least one shared device and the third certificate, and this license has a corresponding relationship with the at least one shared device.

[0236] Exemplarily, for the first audio-visual data, the mobile phone may encrypt the first key of the first audio-visual data with the third public key in the third certificate to obtain a fourth key. The mobile phone then generates a first license for at least one shared device according to the fourth key, its own first signature, and the identification information of the at least one shared device.

[0237] Exemplarily again, for the second audio-visual data, the mobile phone may encrypt the first key of the second audio-visual data with the third public key in the third certificate to obtain a fourth key. The mobile phone then generates a second license for at least one shared device according to the fourth key, its own first signature, and the identification information of the at least one shared device.

[0238] In this way, in the scenario where the first key is updated (for example, the first keys of the above-mentioned first audio-visual data and the second audio-visual data are different), the first license and the second license generated by the mobile phone can further ensure that at least one shared device shares the audio-visual data with the mobile phone according to the corresponding license.

[0239] The embodiments of the present application can authorize the use of third-party devices through licenses, so that the audio-visual data collected by the monitoring device can be shared, improving the flexibility of data transmission, and thus enhancing the usage experience of administrator users and other third-party users.

[0240] In some embodiments of the present application, during the process that the mobile phone generates licenses for at least one shared device according to the fourth key, the first signature, and the identification information of at least one shared device, the mobile phone may further configure shared information, and generate licenses for at least one shared device according to the shared information, the fourth key, the first signature, and the identification information of at least one shared device.

[0241] Among them, the shared information is used for the mobile phone to share video and audio data when running the smart life application; the shared information includes one or more of the application identifier of the smart life application, the validity period corresponding to the video and audio data, the sharing method of the video and audio data, and the permission information corresponding to the video and audio data; the validity period is used to represent the effective time for the mobile phone to share video and audio data with at least one shared device, the sharing method is used to represent the communication connection method between the electronic device and at least one shared device when sharing video and audio data, and the permission information is used to represent the permission operation method of at least one shared device for the video and audio data when the mobile phone shares the video and audio data.

[0242] During the process that the mobile phone generates licenses for at least one shared device, the mobile phone may also impose one or more restrictions on at least one shared device, such as the sharing method, the validity period, and the sharing permission. For example, at least one shared device is prohibited from modifying the video and audio data. For another example, at least one shared device is prohibited from sharing the video and audio data. For another example, the validity period for at least one shared device to access the video and audio data is 24h. For another example, at least one shared device needs to be connected to the same local area network as the mobile phone.

[0243] Based on the above content, the embodiments of the present application can manage various permissions such as the usage period, storage, and distribution of third-party device usage by adding usage constraints to the license. This improves the sharing security of video and audio data and can protect the privacy information in the video and audio data.

[0244] In some embodiments of the present application, in the scenario where the shared device is bound to the monitoring device and a third-party user uses the shared device to view the video and audio data collected by the monitoring device, refer to Figure 14 , the shared device may send a video and audio stream acquisition request to the server (step 1401). The video and audio stream acquisition request may include the content identifier of the video and audio data. Based on the video and audio stream acquisition request, the server sends the video and audio stream corresponding to the content identifier of the video and audio data to the shared device (step 1402). The shared device receives the video and audio stream sent by the server, can parse the video and audio stream to obtain the content identifier of the video and audio data (step 1403), and search for the first key corresponding to the content identifier of the video and audio data locally according to the content identifier of the video and audio data (step 1404).

[0245] It can be understood that the first key is derived between the electronic device, i.e., the electronic device used by the administrator user, and the monitoring device. In this way, the first key corresponding to the content identifier of the audio-visual data does not exist locally in the shared device. In the case where the first key is not stored in the shared device, the shared device can send a license acquisition request to the server (step 1405), and the license acquisition request includes the identifier information of the shared device and the content identifier of the audio-visual data. The server can send the license of the shared device to the shared device based on the license acquisition request (step 1406). The shared device can use the third private key in the third public-private key pair to decrypt the fourth key in the license to obtain the first key (step 1407). Furthermore, the shared device uses the first key to decrypt the third key in the audio-visual stream to obtain the second key (step 1408), and uses the second key to decrypt the encrypted data to obtain the audio-visual data and play the audio-visual data (step 1409).

[0246] In some embodiments of the present application, during the process of generating licenses for at least one shared device by the mobile phone, a license corresponding to the mobile phone can also be generated based on the identifier information of the mobile phone. Similarly, the first key can be encrypted with the first public key to obtain the fifth key, and the first signature can be generated using the second private key. Then, the mobile phone uses the fifth key, the first signature, and the identifier information of the mobile phone to generate a license corresponding to the mobile phone. The mobile phone can save its own license locally or send it to the server for storage.

[0247] In this way, if the first key negotiated between the mobile phone and the monitoring device is updated, it is possible that the updated first key is not stored locally in the mobile phone, while the updated first key corresponds to the audio-visual stream to be shared. In order to avoid the above situation, during the process of the user sharing the audio-visual data collected by the monitoring device with other third-party users, the mobile phone can query the content identifier and the first key of the audio-visual data corresponding to the identifier information of the monitoring device saved locally according to the identifier information of the monitoring device. If the mobile phone does not find the first key corresponding to the identifier information of the monitoring device, it requests the license of its own device locally or from the server using the identifier information of the mobile phone and the content identifier of the audio-visual data, and obtains the first key from the license.

[0248] It should be noted that the mobile phone can also generate different licenses corresponding to itself for different audio-visual data. The embodiments of the present application do not specifically limit the implementation manner of generating licenses.

[0249] In this way, in the scenario where the first key is updated, the mobile phone can still obtain the updated first key from the license, which is convenient for subsequent playing and sharing of audio-visual data.

[0250] In some embodiments of the present application, the mobile phone can also query the CA for the third certificates of at least one shared device, and generate licenses corresponding to the at least one shared device according to the third certificates corresponding to the at least one shared device. The mobile phone then sends the licenses corresponding to the at least one shared device to the server for storage by the server, or forwards the licenses corresponding to the at least one shared device to the at least one shared device. Subsequently, the at least one shared device can view the video and audio data shared by the mobile phone based on the licenses corresponding to the at least one shared device.

[0251] In some embodiments of the present application, the data transmission method provided by the embodiments of the present application is not limited to transmitting video and audio data, and can also be applicable to transmitting data such as images and documents to achieve data privacy protection from the sender to the receiver.

[0252] In some embodiments of the present application, the server may include an authorization forwarding service and a platform service system. Among them, the authorization forwarding service is used to store and distribute the binding relationships between multiple devices and the certificates, licenses, etc. corresponding to the devices, and the platform service system is used to store and distribute the video and audio streams collected by the monitoring devices and the binding information between the devices, etc.

[0253] In some solutions, multiple embodiments of the present application can be combined and the combined solution can be implemented. Optionally, some operations in the processes of the method embodiments are optionally combined, and / or the order of some operations is optionally changed. Moreover, the execution order between the steps of each process is only exemplary and does not constitute a limitation on the execution order between the steps. There can also be other execution orders between the steps. It is not intended to indicate that the execution order is the only order in which these operations can be performed.

[0254] Those of ordinary skill in the art will think of various ways to reorder the operations described in the embodiments of the present application. In addition, it should be noted that the process details involved in a certain embodiment of the present application are equally applicable to other embodiments in a similar manner, or different embodiments can be combined and used.

[0255] In addition, some steps in the method embodiments can be equivalently replaced with other possible steps. Or, some steps in the method embodiments can be optional and can be deleted in some usage scenarios. Or, other possible steps can be added in the method embodiments.

[0256] Moreover, the method embodiments can be implemented separately or in combination.

[0257] The embodiments of the present application also provide an electronic device, such as the above-mentioned mobile phone, which may include one or more processors, a memory, and a communication interface.

[0258] The memory, communication interface are coupled to the processor. For example, the memory, communication interface and processor can be coupled together through a bus.

[0259] The communication interface is used for data transmission with other devices. Computer program code is stored in the memory. The computer program code includes computer instructions, which when executed by the processor, cause the electronic device to perform the relevant method steps in the embodiments of the present application.

[0260] The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The above-mentioned bus can be divided into an address bus, a data bus, a control bus, etc.

[0261] The embodiments of the present application also provide a monitoring device, which includes a memory, one or more processors and a camera; the camera is used for collecting audio-visual data, and the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, which when executed by the processor, cause the monitoring device to perform the relevant method steps in the above method embodiments.

[0262] The embodiments of the present application also provide a communication device, see Figure 15 in (A) of, the communication device includes a key encryption module 1501 and a communication module 1502.

[0263] Among them, the key encryption module 1501 is used for encrypting the second key with the first key to obtain the third key; the first key is used for encrypting the second key corresponding to the audio-visual data, and the second key is used for encrypting the audio-visual data.

[0264] The key encryption module 1501 is also used for encrypting the audio-visual data with the second key to obtain encrypted data.

[0265] The communication module 1502 is used for sending an audio-visual stream to the server, and the audio-visual stream includes the content identifier of the audio-visual data, the third key and the encrypted data. The communication device can perform some or all of the steps in the above data transmission method embodiments.

[0266] The embodiments of the present application also provide another communication device, see Figure 15 in (B) of, the communication device includes a key negotiation module 1503 and a communication module 1504.

[0267] Among them, the key negotiation module 1503 is used for negotiating a key with the monitoring device to generate the first key.

[0268] A communication module 1504 is configured to send the content identifier of the video and audio data to the monitoring device. The content identifier of the video and audio data is used for the monitoring device to establish a correspondence between the generated first key and the content identifier. The first key is used to encrypt the second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data. This communication device can execute some or all of the steps in the above data transmission method embodiments.

[0269] An embodiment of the present application further provides a transmission system, which includes the above-mentioned electronic device and the monitoring device. The transmission system provided by the embodiment of the present application can execute some or all of the steps in the above data transmission method embodiments.

[0270] An embodiment of the present application further provides a computer-readable storage medium, in which computer program code is stored. When the above-mentioned processor executes the computer program code, the electronic device executes the relevant method steps in the above method embodiments.

[0271] An embodiment of the present application further provides a computer program product. When the computer program product runs on a computer, the computer is caused to execute the relevant method steps in the above method embodiments.

[0272] An embodiment of the present application further provides a chip system, including: a processor, the processor is coupled to a memory, and the memory is used to store programs or instructions. When the programs or instructions are executed by the processor, the chip system implements the method in any of the above method embodiments.

[0273] Optionally, the processor in the chip system can be one or more. The processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0274] Optionally, the memory in the chip system can also be one or more. The memory can be integrated with the processor or can be separately arranged from the processor, which is not limited in the embodiments of the present application. Exemplarily, the memory can be a non-transitory processor, such as a read-only memory ROM, which can be integrated with the processor on the same chip or can be separately arranged on different chips. The embodiments of the present application do not make specific limitations on the type of the memory and the setting manner of the memory and the processor.

[0275] Exemplarily, the chip system may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SoC), a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), a micro controller unit (MCU), a programmable logic device (PLD), or other integrated chips.

[0276] The electronic device, computer storage medium, or computer program product provided in this application is all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be elaborated here.

[0277] Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the above division of each functional module is used as an example. In actual applications, the above functions can be allocated to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0278] In the several embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point, the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be electrical, mechanical, or other forms.

[0279] The units described as separate components may or may not be physically separated. The components displayed as units may be one physical unit or multiple physical units, and can be located in one place or distributed to multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0280] In addition, in each embodiment of the present application, each functional unit can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0281] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of the present application, in essence, or the part that makes a contribution, or all or part of the technical solution, can be embodied in the form of a software product. The software product is stored in a storage medium and includes several instructions for causing a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods in the various embodiments of the present application. The foregoing storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read only memory (ROM), random access memory (RAM), magnetic disks, or optical discs.

[0282] The above content is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data transmission method, characterized in that, applied to a monitoring device, the method includes: encrypting a second key with a first key to obtain a third key; the first key is used to encrypt the second key corresponding to the video and audio data, and the second key is used to encrypt the video and audio data; encrypting the video and audio data with the second key to obtain encrypted data; sending a video and audio stream to a server, the video and audio stream including a content identifier of the video and audio data, the third key, and the encrypted data.

2. The method according to claim 1, characterized in that, the method further includes: performing key negotiation with an electronic device to generate the first key.

3. The method according to claim 2, characterized in that, the method further includes: generating the second key.

4. The method according to claim 2 or 3, characterized in that, the method further includes: applying for a first certificate from a certificate authority according to a first public key of the monitoring device; the first certificate is used for binding the electronic device and the monitoring device.

5. The method according to claim 4, characterized in that, the method further includes: receiving a certificate exchange request sent by the electronic device; sending the identification information of the monitoring device and the first certificate to the electronic device.

6. A data transmission method, characterized in that, applied to an electronic device, the method includes: performing key negotiation with a monitoring device to generate a first key; sending a content identifier of video and audio data to the monitoring device, the content identifier of the video and audio data being used by the monitoring device to establish a correspondence between the generated first key and the content identifier, the first key being used to encrypt a second key corresponding to the video and audio data, and the second key being used to encrypt the video and audio data.

7. The method according to claim 6, characterized in that, the method further includes: receiving a play operation for the video and audio data and sending a video and audio stream acquisition request; receiving a video and audio stream sent by the server; the video and audio stream includes a content identifier of the video and audio data, a third key, and encrypted data, the encrypted data being encrypted by a second key, and the third key being obtained by encrypting the second key with the first key; decrypting the third key according to the first key corresponding to the content identifier of the video and audio data to obtain the second key; decrypting the encrypted data with the second key to obtain the video and audio data and playing the video and audio data.

8. The method according to claim 7, characterized in that, the method further includes: receiving a sharing operation for the video and audio data, and applying to the server for at least one shared device bound to the monitoring device and a third certificate of the at least one shared device; generating a license for the at least one shared device based on the identification information of the at least one shared device and the third certificate; sending the license of the at least one shared device to the server, the license being used for the at least one shared device to share the video and audio data with the electronic device.

9. The method according to claim 8, wherein, generating the license for the at least one shared device based on the identification information of the at least one shared device and the third certificate includes: encrypting the first key with the third public key in the third certificate to obtain a fourth key; generating a first signature using the second private key of the electronic device; generating the license for the at least one shared device according to the fourth key, the first signature, and the identification information of the at least one shared device.

10. The method according to claim 9, wherein, generating the license for the at least one shared device according to the fourth key, the first signature, and the identification information of the at least one shared device includes: configuring shared information; the shared information is used for the electronic device to share the audio and video data when running the target application; the shared information includes one or more of the application identifier of the target application, the validity period of the audio and video data, the sharing method of the audio and video data, and the permission information of the audio and video data; wherein, the validity period is used to represent the effective time for the electronic device to share the audio and video data with the at least one shared device, the sharing method is used to represent the communication connection method between the electronic device and the at least one shared device when sharing the audio and video data, and the permission information is used to represent the permission operation method of the at least one shared device for the audio and video data when the electronic device shares the audio and video data; generating the license for the at least one shared device according to the shared information, the fourth key, the first signature, and the identification information of the at least one shared device.

11. The method according to claim 9 or 10, wherein, the method further includes: applying for a second certificate from a certificate authority according to the second public key of the electronic device; the second certificate is used for binding the electronic device and the monitoring device.

12. The method according to claim 11, wherein, the method further includes: sending a certificate exchange request; receiving the identification information and the first certificate of the monitoring device sent by the monitoring device; sending an association request and association information to the server, the association request is used to request binding the electronic device and the monitoring device, and the association information includes the identification information of the monitoring device, the first certificate, the identification information of the electronic device, and the second certificate.

13. The method according to claim 12, wherein, the method further includes: receiving a binding success response sent by the server; outputting a prompt message according to the binding success response, the prompt message is used to prompt that the electronic device and the monitoring device have been bound.

14. A data transmission method, wherein, applied to a transmission system, the transmission system includes an electronic device and a monitoring device, the electronic device is used to control the monitoring device, and the method includes: the electronic device performs key negotiation with the monitoring device to generate a first key; The electronic device sends the content identifier of the audio-visual data to the monitoring device. The content identifier of the audio-visual data is used by the monitoring device to establish a correspondence between the generated first key and the content identifier. The first key is used to encrypt the second key corresponding to the audio-visual data, and the second key is used to encrypt the audio-visual data; The monitoring device encrypts the second key using the first key to obtain a third key; The monitoring device encrypts the audio-visual data using the second key to obtain encrypted data; The monitoring device sends an audio-visual stream, which includes the content identifier of the audio-visual data, the third key, and the encrypted data.

15. The method according to claim 14, wherein, the transmission system further includes a server, and the method further includes: The electronic device receives a playback operation for the audio-visual data and sends an audio-visual stream acquisition request; The electronic device receives the audio-visual stream sent by the server; The electronic device decrypts the third key according to the first key corresponding to the content identifier of the audio-visual data to obtain the second key; The encrypted data is decrypted using the second key to obtain the audio-visual data, and the audio-visual data is played.

16. The method according to claim 15, wherein, the method further includes: The electronic device receives a sharing operation for the audio-visual data and applies to the server for at least one shared device bound to the monitoring device and a third certificate of the at least one shared device; The electronic device generates a license for the at least one shared device based on the identification information of the at least one shared device and the third certificate; The electronic device sends the license of the at least one shared device to the server, and the license is used for the at least one shared device to share the audio-visual data with the electronic device.

17. The method according to claim 16, wherein, the electronic device generates a license for the at least one shared device based on the identification information of the at least one shared device and the third certificate, including: The electronic device encrypts the first key using the third public key in the third certificate to obtain a fourth key; The electronic device generates a first signature using the second private key of the electronic device; The electronic device generates a license for the at least one shared device according to the fourth key, the first signature, and the identification information of the at least one shared device.

18. A monitoring device, wherein, the monitoring device includes a memory, one or more processors, and a camera; the camera is used to collect audio-visual data, and the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions. When the computer instructions are executed by the processor, the monitoring device executes the data transmission method according to any one of claims 1-5.

19. An electronic device, wherein, The electronic device includes a memory and one or more processors; the memory is coupled to the processor; wherein, computer program code is stored in the memory, and the computer program code includes computer instructions, and when the computer instructions are executed by the processor, the electronic device is caused to execute the data transmission method according to any one of claims 6-13.

20. A computer-readable storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions run on a computer, the computer is caused to execute the data transmission method according to any one of claims 1-5, or execute the data transmission method according to any one of claims 6-13.

Images